From: Maximilian Blenk <[email protected]> If selinux is enabled, the context of the mountpoint for overlayfs needs to be specified manually via the rootcontext option. To this end, the required context is determined using matchpathcon(1) and passed via the rootcontext mount option.
Additionally, if the mount source directory is created by mount-copybind it also needs to take care that the context of the directory is correct Signed-off-by: Tobias Kaufmann <[email protected]> --- .../volatile-binds/files/mount-copybind | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/meta/recipes-core/volatile-binds/files/mount-copybind b/meta/recipes-core/volatile-binds/files/mount-copybind index 57a5ce5f21..aad022c6e4 100755 --- a/meta/recipes-core/volatile-binds/files/mount-copybind +++ b/meta/recipes-core/volatile-binds/files/mount-copybind @@ -31,6 +31,13 @@ if [ -d "$mountpoint" ]; then else specdir_existed=no mkdir "$spec" + # If the $spec directory is created we need to take care that + # the selinux context is correct + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + restorecon "$spec" + fi + fi fi # Fast version of calculating `dirname ${spec}`/.`basename ${spec}`-work @@ -39,7 +46,12 @@ if [ -d "$mountpoint" ]; then # Try to mount using overlay, which is must faster than copying files. # If that fails, fall back to slower copy. - if ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir" "$mountpoint" > /dev/null 2>&1; then + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + mountcontext=",rootcontext=$(matchpathcon -n $mountpoint)" + fi + fi + if ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then if [ "$specdir_existed" != "yes" ]; then cp -aPR "$mountpoint"/. "$spec/" -- 2.33.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#155845): https://lists.openembedded.org/g/openembedded-core/message/155845 Mute This Topic: https://lists.openembedded.org/mt/85479552/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
